Vulnerability Description
An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linaro | Op-Tee | <= 3.15.0 |
| Nxp | I.Mx 6Ultralite | - |
References
- https://github.com/OP-TEE/optee_os/tagsRelease NotesThird Party Advisory
- https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-RefThird Party Advisory
- https://github.com/OP-TEE/optee_os/tagsRelease NotesThird Party Advisory
- https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-RefThird Party Advisory
FAQ
What is CVE-2021-44149?
CVE-2021-44149 is a vulnerability with a CVSS score of 7.8 (HIGH). An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resu...
How severe is CVE-2021-44149?
CVE-2021-44149 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-44149?
Check the references section above for vendor advisories and patch information. Affected products include: Linaro Op-Tee, Nxp I.Mx 6Ultralite.